mirror of
https://gitlab.freedesktop.org/xorg/lib/libx11.git
synced 2026-05-05 12:17:59 +02:00
read-only mirror of https://gitlab.freedesktop.org/xorg/lib/libx11
b469da1430
The functions XGetFontPath, XListExtensions, and XListFonts are vulnerable to an off-by-one override on malicious server responses. The server replies consist of chunks consisting of a length byte followed by actual string, which is not NUL-terminated. While parsing the response, the length byte is overridden with '\0', thus the memory area can be used as storage of C strings later on. To be able to NUL-terminate the last string, the buffer is reserved with an additional byte of space. For a boundary check, the variable chend (end of ch) was introduced, pointing at the end of the buffer which ch initially points to. Unfortunately there is a difference in handling "the end of ch". While chend points at the first byte that must not be written to, the for-loop uses chend as the last byte that can be written to. Therefore, an off-by-one can occur. I have refactored the code so chend actually points to the last byte that can be written to without an out of boundary access. As it is not possible to achieve "ch + length < chend" and "ch + length + 1 > chend" with the corrected chend meaning, I removed the inner if-check. Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org> |
||
|---|---|---|
| include | ||
| m4 | ||
| man | ||
| modules | ||
| nls | ||
| specs | ||
| src | ||
| .gitignore | ||
| AUTHORS | ||
| autogen.sh | ||
| configure.ac | ||
| COPYING | ||
| cpprules.in | ||
| docbook.am | ||
| Makefile.am | ||
| NEWS | ||
| README | ||
| x11-xcb.pc.in | ||
| x11.pc.in | ||
libX11 - Core X11 protocol client library
Documentation for this library can be found in the included man pages,
and in the Xlib spec from the specs subdirectory, also available at:
http://www.x.org/releases/current/doc/libX11/libX11/libX11.html
http://www.x.org/releases/current/doc/libX11/libX11/libX11.pdf
and the O'Reilly Xlib books, which they have made freely available online,
though only for older versions of X11:
- X Series Volume 2: Xlib Reference Manual (1989, covers X11R3)
http://www.archive.org/details/xlibretmanver1102nyemiss
- X Series Volume 2: Xlib Reference Manual, 2nd Edition (1990, covers X11R4)
http://www.archive.org/details/xlibrefmanv115ed02nyemiss
All questions regarding this software should be directed at the
Xorg mailing list:
http://lists.freedesktop.org/mailman/listinfo/xorg
Please submit bug reports to the Xorg bugzilla:
https://bugs.freedesktop.org/enter_bug.cgi?product=xorg
The master development code repository can be found at:
git://anongit.freedesktop.org/git/xorg/lib/libX11
http://cgit.freedesktop.org/xorg/lib/libX11
For patch submission instructions, see:
http://www.x.org/wiki/Development/Documentation/SubmittingPatches
For more information on the git code manager, see:
http://wiki.x.org/wiki/GitPage